<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Hi Fernando-</div>
<div class=""><br class="">
</div>
<div class="">Try checking the /var/log/audit/audit.log file to see if selinux is denying the traffic. That has bitten me more than once. </div>
<div class=""><br class="">
</div>
<div class="">Also try to do the lookup with Net::DNS outside of Radiator. This lookup yielded both the NAPTR and SRV records.</div>
<div class=""><br class="">
</div>
<div class=""><font face="Courier" class="">perl -e 'use Net::DNS;<br class="">
my $res = Net::DNS::Resolver->new; <br class="">
my $reply = $res->query("<a href="http://id.fccn.pt" class="">id.fccn.pt</a>", "NAPTR");<br class="">
foreach $rr ($reply->answer) {<br class="">
$rr->print;<br class="">
if ($rr->service eq "x-eduroam:radius.tls"){<br class="">
my $reply = $res->query($rr->replacement, "SRV");<br class="">
foreach $rr ($reply->answer) {$rr->print;}}}'</font></div>
<div class=""><font face="Courier" class=""><br class="">
<a href="http://id.fccn.pt" class="">id.fccn.pt</a>.<span class="Apple-tab-span" style="white-space: pre;">
</span>84181<span class="Apple-tab-span" style="white-space: pre;"> </span>IN<span class="Apple-tab-span" style="white-space: pre;">
</span>NAPTR<span class="Apple-tab-span" style="white-space: pre;"> </span>( 100 10 s x-eduroam:radius.tls ""<br class="">
<span class="Apple-tab-span" style="white-space: pre;"></span>_radsec._<a href="http://tcp.fccn.pt" class="">tcp.fccn.pt</a>. )<br class="">
_radsec._<a href="http://tcp.fccn.pt" class="">tcp.fccn.pt</a>.<span class="Apple-tab-span" style="white-space: pre;">
</span>84181<span class="Apple-tab-span" style="white-space: pre;"> </span>IN<span class="Apple-tab-span" style="white-space: pre;">
</span>SRV<span class="Apple-tab-span" style="white-space: pre;"> </span>0 0 2083 <a href="http://radius01.fccn.pt" class="">radius01.fccn.pt</a>.<br class="">
_radsec._<a href="http://tcp.fccn.pt" class="">tcp.fccn.pt</a>.<span class="Apple-tab-span" style="white-space: pre;">
</span>84181<span class="Apple-tab-span" style="white-space: pre;"> </span>IN<span class="Apple-tab-span" style="white-space: pre;">
</span>SRV<span class="Apple-tab-span" style="white-space: pre;"> </span>0 10 2083 <a href="http://radius02.fccn.pt" class="">radius02.fccn.pt</a>.</font></div>
<div class=""><br class="">
</div>
<div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-position: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; line-height: normal; border-spacing: 0px;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;" class=""><span class="Apple-style-span" style="font-size: 15px;"><b class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class=""><span><span><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant-ligatures: normal; font-variant-position: normal; font-variant-caps: normal; font-variant-numeric: normal; font-variant-alternates: normal; font-variant-east-asian: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;" class=""><span class="Apple-style-span" style="font-size: 15px;"><b class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class=""><font color="#002e7a" class="">ClearSky</font></span><font color="#002e7a" class=""><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">
</span><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">Technologies</span><span style="font-size: 10pt; font-family: Arial, sans-serif;" class="">, Inc.</span></font></b></span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;" class="">
<span class="Apple-style-span" style="font-size: 15px; "><b class=""><span style="font-size: 10pt; color: rgb(38, 38, 38); font-family: Arial, sans-serif; " class="">Frank Danielson |</span></b></span><span class="Apple-style-span" style="font-size: 15px; "><b class=""><span style="font-size: 10pt; color: rgb(31, 73, 125); font-family: Arial, sans-serif; " class=""> </span></b></span><span class="Apple-style-span" style="font-size: 15px; "><b class=""><i class=""><span style="font-size: 10pt; color: rgb(49, 132, 155); font-family: Arial, sans-serif; " class="">Chief
Technology Officer</span></i></b></span></div>
<span class="Apple-style-span" style="color: rgb(0, 0, 0); font-family: Calibri, sans-serif; font-size: 14px;"><font class="Apple-style-span" color="#1f497d"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="font-family: Calibri, sans-serif; font-size: 14px; ">
<div style="color: rgb(0, 0, 0); margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; " class="">
<span style="font-size: 10pt; font-family: Wingdings; color: rgb(64, 64, 64); " class="">*</span><span style="font-size: 7.5pt; color: rgb(89, 89, 89); font-family: 'MS Sans Serif'; " class=""> </span><span style="text-decoration: underline; font-size: 7.5pt; color: blue; font-family: 'MS Sans Serif'; " class=""><a href="applewebdata://B42CE82B-00AD-4466-A1C0-45CE1FB8AEBB/notifications@csky.com" style="color: blue; text-decoration: underline; " class="">fdanielson@csky.com</a></span></div>
</span></span></font></span></span></span></span></span></b></span></div>
<b class=""></b></span></div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 17, 2017, at 2:06 PM, Fernando Reis <<a href="mailto:fereis@ipcb.pt" class="">fereis@ipcb.pt</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Hello,<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">We are in the process of implementing radsec on our server but when using authby DNSROAM the SRV lookup always fail:<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Radiator logs:<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:20 2017: DEBUG: Handling with Radius::AuthDNSROAM<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:20 2017: DEBUG: Resolver doing NAPTR lookup for<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a>,<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:20 2017: DEBUG: AuthBy DNSROAM result: IGNORE, Discovering RadSec servers<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:20 2017: DEBUG: Resolver found NAPTR record for realm<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a>:<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a>.
73857 IN NAPTR ( 100 10 s x-eduroam:radius.tls ""<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""> _radsec._<a href="http://tcp.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">tcp.fccn.pt</a>. )<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:20 2017: DEBUG: Resolver doing SRV lookup for _radsec._<a href="http://tcp.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">tcp.fccn.pt</a>, Protocol radius Transport tcp UseTLS 1
Order 100 Preference 10<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:25 2017: INFO: Resolver: No reply from DNS for SRV request for realm<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Fri Mar 17 15:56:25 2017: DEBUG: AuthBy DNSROAM: No hardwired Route, no discovered Route, using DEFAULT Route for<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">When we do a tcpdump on the radius server we see that the dns server responds to the request but the radius sends (final line) port unreachable and the resolving of the SRV request fails:<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Tcpdump radius (193.137.66.131) > dns (193.137.66.129):<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">12:37:13.937148 IP 193.137.66.131.40586 > 193.137.66.129.53: 63986+ NAPTR?<span class="Apple-converted-space"> </span><a href="http://id.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">id.fccn.pt</a>.
(28)<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">12:37:13.937383 IP 193.137.66.129.53 > 193.137.66.131.40586: 63986 1/0/6 NAPTR (268)<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">12:37:13.945746 IP 193.137.66.131.40586 > 193.137.66.129.53: 37804+ SRV? _radsec._<a href="http://tcp.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">tcp.fccn.pt</a>. (38)<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">12:37:13.946034 IP 193.137.66.129.53 > 193.137.66.131.40586: 37804 2/0/4 SRV<span class="Apple-converted-space"> </span><a href="http://radius01.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">radius01.fccn.pt</a>.:2083
0 0, SRV<span class="Apple-converted-space"> </span><a href="http://radius02.fccn.pt/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">radius02.fccn.pt</a>.:2083 0 10 (198)<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">12:37:13.946058 IP 193.137.66.131 > 193.137.66.129: ICMP 193.137.66.131 udp port 40586 unreachable, length 234<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">I’ve installed all the necessary modules: Net::DNS + Socket6 + IO::Socket::INET6 for this to work but it always fails.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class="">Anyone has an idea how to solve this?<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">
<span lang="EN-US" class=""><o:p class=""> </o:p></span></div>
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>